Skip to content
System management
ASD ISMISM-2149

ASD ISM 2149 Develop, enforce and maintain an authorised RMM and remote access tool list

What it says

A list of authorised RMM tools and remote access tools is developed, enforced and maintained.

Quoted as published. Everything else on this page is written by Control Stack.

What it means

In plain English

Keep a current, approved list of remote monitoring and management (RMM) and remote access tools, and block anything not on it from running or connecting.

Remote monitoring and management (RMM) tools and remote access tools (think AnyDesk, TeamViewer, ScreenConnect, Splashtop and similar) let someone see and control a computer from anywhere. That is exactly what IT teams and managed service providers need, and it is also exactly what an attacker wants. Cyber criminals routinely install a second, unsanctioned remote tool on a compromised machine because it looks like normal admin software, survives reboots and gives them a persistent, encrypted door back in. This control asks for three things. First, **develop** a list of the RMM and remote access tools your organisation has actually authorised. Second, **enforce** that list, so tools that are not on it cannot be installed, run or connect. Third, **maintain** the list, so it stays accurate as tools are added, replaced or retired. It matters because a remote tool you have not approved is indistinguishable from an intrusion. Without an authoritative list you cannot tell a technician's legitimate session from an attacker's, and without enforcement the list is just a document that nobody has to follow.

Why it matters

If no authorised list exists, or it is not enforced, anyone (staff, contractors, service providers or an attacker who has gained a foothold) can install whichever remote access tool they like. Unsanctioned tools become a persistent backdoor that blends in with normal administrative traffic, allowing attackers to return at will, move between systems and exfiltrate data while security teams see nothing unusual. A stale list creates the opposite failure: legitimate tools drop off the record and tools that should have been retired keep working, so enforcement decisions are made against the wrong baseline. Either way the organisation loses the ability to say with confidence which remote pathways into its environment are supposed to be there.

How to implement

  1. IT operations, with the security team, inventories every RMM and remote access tool currently installed or in use across the organisation and its service providers by querying endpoint management and application discovery data, then records each tool, its owner, its purpose and its approval decision in a single authorised list.

  2. The security team defines the approval criteria and the change process for the list (who can request a tool, who approves it, and what must be checked before approval) and documents that process so additions and removals are consistent and traceable.

  3. Endpoint engineers enforce the list on workstations and servers by configuring application control or endpoint protection to allow only the authorised tools' executables, installers and services, and to block and alert on any other RMM or remote access software.

  4. Network engineers enforce the list at the perimeter by allowing outbound connections only to the relay and cloud services used by authorised tools, and blocking or alerting on connections to the known service endpoints of tools that are not authorised.

  5. The control owner schedules a periodic review of the list (and triggers a review whenever a tool is deployed, replaced or retired) that reconciles the list against what is actually installed, removes retired tools from endpoints and network allow rules, and records the review outcome and date.

Keep it running

Day to day, the authorised list is the reference point for three routine activities.

Keep the list somewhere version-controlled or change-tracked so that who added or removed a tool, and when, can be shown later. Make sure service providers who support your environment are told which tools are permitted and that their contracts reflect it.

  • **Requests for a new tool** (from IT, a business unit or a managed service provider) go through an approval step before the tool is added to the list and allowed by the enforcement controls. Until then the request is a no.
  • **Enforcement** runs continuously in the background, typically through application control, endpoint protection rules, and network or firewall rules that block the executables, installers and outbound connections of tools that are not authorised. Blocked attempts should generate an alert, because a blocked remote tool on a workstation is often the first visible sign of an intrusion or of a service provider working outside agreed arrangements.
  • **Maintenance** means the list is reviewed on a set cadence (and whenever a tool is deployed, replaced or decommissioned) so that it reflects what is actually in use. Retiring a tool should include removing it from endpoints and revoking its network allowances, not just deleting a line from the list.

Evidence and audit

  1. Check 1 of 5What an auditor asks for

    Ask for

    Ask for the current authorised list of RMM and remote access tools.

    Look at

    Check that it names each tool, its owner and purpose, and who approved it and when, and that it has a review or version history.

    Good evidence

    A single authoritative list exists, is clearly owned, and shows recent dated changes rather than a one-off document.

  2. Check 2 of 5What an auditor asks for

    Ask for

    Ask for the process used to add a tool to, or remove a tool from, the list.

    Look at

    Look for defined approval criteria, named approvers, and examples of requests that were approved and requests that were declined.

    Good evidence

    Additions and removals follow a documented process with evidence that it has actually been used, including at least one refusal.

  3. Check 3 of 5What an auditor asks for

    Ask for

    Ask for the endpoint configuration that enforces the list, such as application control or endpoint protection rules.

    Look at

    Check that the allowed set matches the authorised list and that unlisted remote tools are blocked rather than merely logged, and confirm coverage across workstations and servers.

    Good evidence

    Enforcement rules mirror the list exactly, apply to all relevant systems, and a test of an unauthorised tool is blocked.

  4. Check 4 of 5What an auditor asks for

    Ask for

    Ask for network or firewall rules and alerts relating to remote access tool traffic.

    Look at

    Look for rules that permit only authorised tools' service endpoints and for alerts or block logs showing attempts by unauthorised tools.

    Good evidence

    Outbound access is restricted to authorised tools, and blocked attempts are visible to and reviewed by the security team.

  5. Check 5 of 5What an auditor asks for

    Ask for

    Ask for the most recent reconciliation of the list against what is actually installed, and for any decommissioning records.

    Look at

    Check that discovered software was compared to the list, discrepancies were actioned, and retired tools were removed from endpoints and enforcement rules.

    Good evidence

    The list matches reality, the review is dated and signed off, and retired tools no longer appear in inventory or allow rules.

Mappings

Closest match in ASD Essential Eight: E8-AC-ML1.3, Ensure only approved applications and scripts can run, which partially overlaps with this control.

ISO 27001

ISO/IEC 27001: 1 mapping

  • A.5.15Access control policies and proceduresSupports
Essential Eight

ASD Essential Eight: 3 mappings

  • E8-AC-ML1.3Ensure only approved applications and scripts can runPartially overlaps
  • E8-AC-ML1.1Application control is implemented on workstations.Supports
  • E8-AC-ML2.1Application control is implemented on internet-facing serversSupports

Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.